On January 12, 2017, Swiss Federal Councillor Johann Schneider-Ammann announced the approval of the Swiss-U.S. Privacy Shield Framework as a valid legal mechanism to comply with Swiss requirements when transferring personal data from Switzerland to the United States. The Swiss-U.S. Privacy Shield Framework will immediately replace the U.S.-Swiss Safe Harbor immediately. To give organizations the time needed to review the Privacy Shield Principles and the commitments they entail, U.S. Acting Under Secretary of Commerce Ken Hyatt announced that the Department will begin accepting Privacy Shield certifications on April 12, 2017.

Beginning April 12, 2017, the Department of Commerce will no longer accept any U.S.-Swiss Safe Harbor certifications. The Department will maintain the U.S.-Swiss Safe Harbor List of participants.

U.S.-EU Safe Harbor

On July 12, 2016, U.S. Secretary of Commerce Penny Pritzker joined European Union Commissioner Věra Jourová to announce the approval of the EU-U.S. Privacy Shield Framework as a valid legal mechanism to comply with EU requirements when transferring personal data from the European Union to the United States. The EU-U.S. Privacy Shield Framework replaces the U.S.-EU Safe Harbor Framework. The Department began accepting certifications on August 1, 2016.

As of October 31, 2016, the Department stopped accepting all U.S.-EU Safe Harbor certifications. The Department will maintain the U.S.-EU Safe Harbor List of participants.

Please note that, pursuant to the Safe Harbor Frequently Asked Question on Self-Certification, the commitment to adhere to the U.S.-EU and U.S.-Swiss Safe Harbor Principles is not time-limited, and a participating organization must continue to apply the Principles to data received under the Safe Harbor.

For more information on the Swiss-U.S. Privacy Shield Framework and the EU-U.S. Privacy Shield Framework, please visit https://www.privacyshield.gov .

Introduction:

The Swiss Federal Act on Data Protection (FADP) went into effect in July 1993, followed by important modifications in January 2008. The FADP would prohibit the transfer of personal data to countries that do not meet Switzerland’s “adequacy” standard for privacy protection. While the United States and Switzerland share the goal of enhancing privacy protection for their citizens, the United States takes a different approach to privacy from that taken by Switzerland. In order to bridge these differences in approach and provide a streamlined means for U.S. organizations to comply with the FADP, the U.S. Department of Commerce in consultation with the Federal Data Protection and Information Commissioner of Switzerland developed a "safe harbor" framework and this website to provide the information an organization would need to evaluate – and then join – the U.S.-Swiss Safe Harbor program.

Please note that the form used for self-certifying compliance with the U.S.-Swiss Safe Harbor Framework is identical to that used for self-certifying compliance with the U.S.-EU Safe Harbor Framework; nevertheless, an organization is not required to self-certify to one of the Safe Harbor Frameworks in order to self-certify to the other. Organizations should also note that when they select “Switzerland” as a country from which they receive personal data, they are self-certifying compliance with the U.S.-Swiss Safe Harbor Framework. It is critically important that an organization read the U.S.-Swiss Safe Harbor Privacy Principles, 15 FAQs, and enforcement documents before submitting a self-certification form.

Upon receipt of your organization’s self-certification submission and corresponding processing fee, the submission will be reviewed for completeness. If and when the submission is deemed complete, it will be posted to the U.S.-Swiss Safe Harbor List, available on this website.